California Shopping Centers Are Spying for an ICE Contractor

Update July 12, 2018. On July 11, Vigilant Solutions issued a press release disputing EFF’s report. We have posted the details and our response in a new post.

Update 10:45 a.m., July 11, 2018: The Irvine Company has disclosed the three shopping centers are Irvine Spectrum Center, Fashion Island, and The Marketplace. The local police departments are the Irvine, Newport Beach, and Tustin police departments.

Update 7:30 p.m. July 10, 2018: The Irvine Company provided The Verge with the following response.

“Irvine Company is a customer of Vigilant Solutions. Vigilant employs ALPR technology at our three Orange County regional shopping centers. Vigilant is required by contract, and have assured us, that ALPR data collected at these locations is only shared with local police departments as part of their efforts to keep the local community safe.”

EFF urges the Irvine Company to release the names of the three regional shopping centers that are under surveillance and to provide a copy of the contract indicating the data is only shared with local police. The company should also release the names of which local agencies are accessing its data. We remain concerned and skeptical. EFF would appreciate any information that would clear up this matter. The public deserves greater transparency from The Irvine Company and Vigilant Solutions.

A company that operates 46 shopping centers up and down California has been providing sensitive information collected by automated license plate readers (ALPRs) to Vigilant Solutions, a surveillance technology vendor that in turn sells location data to Immigrations & Customs Enforcement.

The Irvine Company—a real estate company that operates malls and mini-malls in Irvine, La Jolla, Newport Beach, Redwood City, San Jose, Santa Clara and Sunnyvale—has been conducting the ALPR surveillance since just before Christmas 2016, according to an ALPR Usage and Privacy Policy published on its website (archived version). The policy does not say which of its shopping centers use the technology, only disclosing that the company and its contractors operates ALPRs at “one or more” of its locations.

Automated license plate recognition is a form of mass surveillance in which cameras capture images of license plates, convert the plate into plaintext characters, and append a time, date, and GPS location. This data is usually fed into a database, allowing the operator to search for a particular vehicle’s travel patterns or identify visitors to a particular location. By adding certain vehicles to a “hot list,” an ALPR operator can receive near-real time alerts on a person’s whereabouts.

EFF contacted the Irvine Company with a series of questions about the surveillance program, including which malls deploy ALPRs and how much data has been collected and shared about its customers and employees. After accepting the questions via phone, Irvine Company did not provide further response or answer questions.

The Irvine Company’s policy describes a troubling relationship between the retail world and the surveillance state. The cooperation between the two companies allows the government to examine the travel patterns of consumers on private property with little transparency and no consent from those being tracked. As private businesses, Vigilant Solutions and the Irvine Company are generally shielded from transparency measures such as the California Public Records Act. The information only came to light due to a 2015 law passed in California that requires ALPR operators—both public and private alike—to post their ALPR policies online. Malls in other states where no such law exists could well be engaged in similar violations of customer privacy without any public accountability.

In December 2017, ICE signed a contract with Vigilant Solutions to access its license-plate reader database. Data from Irvine Company’s malls directly feeds into Vigilant Solutions’ database system, according to the policy. This could mean that ICE can spy on mall visitors without their knowledge and receive near-real-time alerts when a targeted vehicle is spotted in a shopping center’s parking lot.

Vigilant Solutions’ dealings with ICE have come under growing scrutiny in California as the Trump administration accelerates its immigrant enforcement. The City of Alameda rejected a contract with Vigilant Solutions following community outcry over its contracts with ICE. The City of San Pablo put an expansion of its surveillance network on hold due to the same concerns.

But ICE isn’t the only agency accessing ALPR data. Vigilant Solutions shares data with as many as 1,000 law enforcement agencies nationwide. Through its sister company, Digital Recognition Network, Vigilant Solutions also sells ALPR data to financial lenders, insurance companies, and debt collectors.

“Irvine is committed to limiting the access and use of ALPR Information in a manner that is consistent with respect for individuals' privacy and civil liberties,” the Irvine Company writes in its policy. “Accordingly, contractors used to collect ALPR Information on Irvine's behalf and Irvine employees are not authorized to access or use the ALPR Information or ALPR System.” And the Irvine Company says it deletes the data once it has been transmitted to Vigilant Solutions.

Although the Irvine Company pays lip service to civil liberties, the company undermines that position by allowing Vigilant Solutions to apply its own policy to the data. Vigilant Solutions does not purge data on a regular basis and instead “retains LPR data as long as it has commercial value.”

The Irvine Company must shut down its ALPR system immediately. By conducting this location surveillance and working with Vigilant Solutions, the company is putting not only immigrants at risk, but invading the privacy of its customers by allowing a third-party to hold onto their data indefinitely.

We will update this post if and when the Irvine Company decides to respond to our questions.

Special thanks to Zoe Wheatcroft, the EFF volunteer who first spotted The Irvine Company's ALPR policy.

Related Updates

EFF and MuckRock have filed hundreds of public records requests with law enforcement agencies around the country to reveal how data collected from automated license plate readers (ALPR) is used to track the travel patterns of drivers. We focused exclusively on departments that contract with surveillance vendor Vigilant Solutions to...

Despite igniting controversy over ethical lapses and the threat to civil liberties posed by its tattoo recognition experiments the first time around, the National Institute of Standards and Technology (NIST) recently completed its second major project evaluating software designed to reveal who we are and potentially what we believe based...

Two individuals with no criminal record—one of whom is a retired California Highway Patrol officer—are asking a California Superior Court why their phones were tapped in 2015. These are just two targets of hundreds of questionable wiretaps authorized by a single judge, Helios J. Hernandez, in Riverside County. EFF and...

San Bernardino, California—The Electronic Frontier Foundation (EFF) sued the San Bernardino County Sheriff’s Department today to gain access to records about search warrants where cell-site simulators, devices that allow police to locate and track people by tricking their cell phones into a connection, were authorized in criminal investigations.EFF...

Journalists face increasingly hostile conditions covering public protests, presidential rallies, corruption, and police brutality in the course of work as watchdogs over government power. A case before the U.S. Supreme Court threatens press freedoms even further by potentially giving the government freer rein to arrest media people in...

For too long, the New York Police Department has secretly deployed cutting-edge spy tech, without notice to the public. Many of these snooping devices invade our privacy, deter our free speech, and disparately burden minority and immigrant communities. Fortunately, a proposed ordinance (“the POST Act”) would lift the cloak of...

This week, two California jurisdictions joined the growing movement to subject government surveillance technology to democratic transparency and civilian control. Each culminated a local process spearheaded by concerned residents who campaigned for years. First, on Monday, the City of Palo Alto voted 8-1 to adopt an ordinance to...

Among the many bills awaiting the signature—or veto—of Governor Jerry Brown is AB 3131, a measure that would ensure transparency about police militarization across the State of California. While we are disappointed in recent legislative amendments that weakened the original bill, we remain eager to see it...

Well, this is a first. In response to an EFF investigation that uncovered deeply troubling research practices by the National Institute for Technology & Standards (NIST), a senior federal scientist stripped off his clothes, had another scientist draw all over his skin with washable markers, and then posed for...

For the second year in a row, the California State Assembly’s Appropriations Committee has effectively killed a bill that was poised to ensure transparency, community oversight, and civil liberties regarding proliferating police surveillance technology. S.B. 1186 was approved by the California Senate, as well as by two Assembly policy...